jb55 on nostr

Open in Damus

@jb55 1720194791

password managers generate a unique password for each website. this means if one of your passwords leaks it won't compromise any of your other website logins.

nostr-login is a regression: if you leak your nsec then they have access to every website that you've ever logged in to.

using your npub for logging into everything is a really bad idea security wise, please be conscious of this before implementing or pushing this as a login solution to websites which may contain sensitive information.

15

This is also ~pretty much true of all single-sign-on schemes like Apple/Google's. I've been annoyed for a long time that logging into YouTube on a device also technically logs me into Gmail. Unique sites should get their own unique secrets.

JohnyDoor · 113w

it's enough to leak your Email password and all your other website passwords will be changed.

Lennart · 113w

Not if you use 2FA.

Its a bit better than using a single password, since that password gets stored on many server side databases with varying security. At least with your nsec, it never gets sent over the internet to a server. It stays on your computer. Still a bad idea to use it to log into everything though.

Can we do something like derived keys? I know not much about cryptography. But would be cool if we could generate child keypairs from a master keypair. And you can somehow revoke/cancel a leaked child key by providing a new child key of the same parent/master.

Thoughts on revokable single-use passwords tied to your nsec? Create it, use it, you’re logged in until you log out, revoke it, or the cookie expires. Create a new one to log in next time. All tied to your nsec, without revealing it. There’s lots of shit wrong with Bluesky, but this feature ...

Stirling Forge · 113w

We need deriviative keys.